Republic of Korea: Signed Bill amending Personal Information Protection Act including cross-border data transfer requirements

On 14 March 2023, Bill No. 2120089, amending the Personal Information Protection Act (PIPA), was signed into Law by the President of the Republic of Korea (ROK), becoming Law No. 19234. The Law outlines conditions for data transfers. In particular, the Law allows data transfers if a country or international organisation has similar levels of data protection as the ROK, if a country has an international agreement in data transfer with the ROK, if the overseas recipient organisation has obtained data protection certification from the ROK Personal Information Protection Committee (PIPC), and if the data transfer is made to fulfil a contract with the data subject where storage details are fully disclosed. The provisions will come into force 6 months following its signing into Law on 15 September 2023.